remoteclaw 0.1.0-next.da482d8 → 0.1.0-next.db8a792

package/dist/dispatcher-Cm2FAG_D.js

@@ -0,0 +1,174 @@
+import { s as escapeRegExp } from "./utils-C5daYcFn.js";
+import { t as createSubsystemLogger } from "./subsystem-m7RSGQoR.js";
+import { i as loadConfig } from "./config-C_WcTz_O.js";
+import { o as resolveBrowserConfig, t as ensureBrowserControlAuth } from "./control-auth-DK6cIBzl.js";
+import { i as registerBrowserRoutes, r as createBrowserRouteContext, t as ensureExtensionRelayForProfiles } from "./server-lifecycle-Cal8hBP1.js";
+import os from "node:os";
+import { promisify } from "node:util";
+import { execFile } from "node:child_process";
+
+//#region src/infra/machine-name.ts
+const execFileAsync = promisify(execFile);
+let cachedPromise = null;
+async function tryScutil(key) {
+	try {
+		const { stdout } = await execFileAsync("/usr/sbin/scutil", ["--get", key], {
+			timeout: 1e3,
+			windowsHide: true
+		});
+		const value = String(stdout ?? "").trim();
+		return value.length > 0 ? value : null;
+	} catch {
+		return null;
+	}
+}
+function fallbackHostName() {
+	return os.hostname().replace(/\.local$/i, "").trim() || "remoteclaw";
+}
+async function getMachineDisplayName() {
+	if (cachedPromise) return cachedPromise;
+	cachedPromise = (async () => {
+		if (process.env.VITEST || false) return fallbackHostName();
+		if (process.platform === "darwin") {
+			const computerName = await tryScutil("ComputerName");
+			if (computerName) return computerName;
+			const localHostName = await tryScutil("LocalHostName");
+			if (localHostName) return localHostName;
+		}
+		return fallbackHostName();
+	})();
+	return cachedPromise;
+}
+
+//#endregion
+//#region src/browser/control-service.ts
+let state = null;
+const logService = createSubsystemLogger("browser").child("service");
+function createBrowserControlContext() {
+	return createBrowserRouteContext({
+		getState: () => state,
+		refreshConfigFromDisk: true
+	});
+}
+async function startBrowserControlServiceFromConfig() {
+	if (state) return state;
+	const cfg = loadConfig();
+	const resolved = resolveBrowserConfig(cfg.browser, cfg);
+	if (!resolved.enabled) return null;
+	try {
+		if ((await ensureBrowserControlAuth({ cfg })).generatedToken) logService.info("No browser auth configured; generated gateway.auth.token automatically.");
+	} catch (err) {
+		logService.warn(`failed to auto-configure browser auth: ${String(err)}`);
+	}
+	state = {
+		server: null,
+		port: resolved.controlPort,
+		resolved,
+		profiles: /* @__PURE__ */ new Map()
+	};
+	await ensureExtensionRelayForProfiles({
+		resolved,
+		onWarn: (message) => logService.warn(message)
+	});
+	logService.info(`Browser control service ready (profiles=${Object.keys(resolved.profiles).length})`);
+	return state;
+}
+
+//#endregion
+//#region src/browser/routes/dispatcher.ts
+function compileRoute(path) {
+	const paramNames = [];
+	const parts = path.split("/").map((part) => {
+		if (part.startsWith(":")) {
+			const name = part.slice(1);
+			paramNames.push(name);
+			return "([^/]+)";
+		}
+		return escapeRegExp(part);
+	});
+	return {
+		regex: new RegExp(`^${parts.join("/")}$`),
+		paramNames
+	};
+}
+function createRegistry() {
+	const routes = [];
+	const register = (method) => (path, handler) => {
+		const { regex, paramNames } = compileRoute(path);
+		routes.push({
+			method,
+			path,
+			regex,
+			paramNames,
+			handler
+		});
+	};
+	return {
+		routes,
+		router: {
+			get: register("GET"),
+			post: register("POST"),
+			delete: register("DELETE")
+		}
+	};
+}
+function normalizePath(path) {
+	if (!path) return "/";
+	return path.startsWith("/") ? path : `/${path}`;
+}
+function createBrowserRouteDispatcher(ctx) {
+	const registry = createRegistry();
+	registerBrowserRoutes(registry.router, ctx);
+	return { dispatch: async (req) => {
+		const method = req.method;
+		const path = normalizePath(req.path);
+		const query = req.query ?? {};
+		const body = req.body;
+		const signal = req.signal;
+		const match = registry.routes.find((route) => {
+			if (route.method !== method) return false;
+			return route.regex.test(path);
+		});
+		if (!match) return {
+			status: 404,
+			body: { error: "Not Found" }
+		};
+		const exec = match.regex.exec(path);
+		const params = {};
+		if (exec) for (const [idx, name] of match.paramNames.entries()) {
+			const value = exec[idx + 1];
+			if (typeof value === "string") params[name] = decodeURIComponent(value);
+		}
+		let status = 200;
+		let payload = void 0;
+		const res = {
+			status(code) {
+				status = code;
+				return res;
+			},
+			json(bodyValue) {
+				payload = bodyValue;
+			}
+		};
+		try {
+			await match.handler({
+				params,
+				query,
+				body,
+				signal
+			}, res);
+		} catch (err) {
+			return {
+				status: 500,
+				body: { error: String(err) }
+			};
+		}
+		return {
+			status,
+			body: payload
+		};
+	} };
+}
+
+//#endregion
+export { getMachineDisplayName as i, createBrowserControlContext as n, startBrowserControlServiceFromConfig as r, createBrowserRouteDispatcher as t };

package/dist/dm-policy-shared-DOzpxMHC.js

@@ -0,0 +1,22 @@
+import { o as normalizeStringEntries } from "./dock-ByrYnLiz.js";
+import { i as readChannelAllowFromStore } from "./pairing-store-CWaGbAGi.js";
+
+//#region src/security/dm-policy-shared.ts
+async function resolveDmAllowState(params) {
+	const configAllowFrom = normalizeStringEntries(Array.isArray(params.allowFrom) ? params.allowFrom : void 0);
+	const hasWildcard = configAllowFrom.includes("*");
+	const storeAllowFrom = await (params.readStore ?? readChannelAllowFromStore)(params.provider).catch(() => []);
+	const normalizeEntry = params.normalizeEntry ?? ((value) => value);
+	const normalizedCfg = configAllowFrom.filter((value) => value !== "*").map((value) => normalizeEntry(value)).map((value) => value.trim()).filter(Boolean);
+	const normalizedStore = storeAllowFrom.map((value) => normalizeEntry(value)).map((value) => value.trim()).filter(Boolean);
+	const allowCount = Array.from(new Set([...normalizedCfg, ...normalizedStore])).length;
+	return {
+		configAllowFrom,
+		hasWildcard,
+		allowCount,
+		isMultiUserDm: hasWildcard || allowCount > 1
+	};
+}
+
+//#endregion
+export { resolveDmAllowState as t };

package/dist/dm-policy-shared-DZY0f1bR.js

@@ -0,0 +1,22 @@
+import { l as normalizeStringEntries } from "./dock-CpNmmysM.js";
+import { i as readChannelAllowFromStore } from "./pairing-store-Bu9pVlkO.js";
+
+//#region src/security/dm-policy-shared.ts
+async function resolveDmAllowState(params) {
+	const configAllowFrom = normalizeStringEntries(Array.isArray(params.allowFrom) ? params.allowFrom : void 0);
+	const hasWildcard = configAllowFrom.includes("*");
+	const storeAllowFrom = await (params.readStore ?? readChannelAllowFromStore)(params.provider).catch(() => []);
+	const normalizeEntry = params.normalizeEntry ?? ((value) => value);
+	const normalizedCfg = configAllowFrom.filter((value) => value !== "*").map((value) => normalizeEntry(value)).map((value) => value.trim()).filter(Boolean);
+	const normalizedStore = storeAllowFrom.map((value) => normalizeEntry(value)).map((value) => value.trim()).filter(Boolean);
+	const allowCount = Array.from(new Set([...normalizedCfg, ...normalizedStore])).length;
+	return {
+		configAllowFrom,
+		hasWildcard,
+		allowCount,
+		isMultiUserDm: hasWildcard || allowCount > 1
+	};
+}
+
+//#endregion
+export { resolveDmAllowState as t };

package/dist/dns-cli-BgsNg-bn.js

@@ -0,0 +1,203 @@
+import "./paths-BTaH3rLn.js";
+import { L as theme } from "./utils-C5daYcFn.js";
+import "./subsystem-m7RSGQoR.js";
+import { i as defaultRuntime } from "./ansi-DtaiOnt1.js";
+import "./agent-scope-DVvX_nkQ.js";
+import { i as loadConfig } from "./config-C_WcTz_O.js";
+import "./env-BJ36dSrx.js";
+import "./host-env-security-BGibnCbS.js";
+import "./shell-env-D8nXPDbP.js";
+import "./version-CVMnqdzu.js";
+import "./env-vars-a7S70ba7.js";
+import "./zod-schema-CCUbW_Si.js";
+import "./ip-BFJnbRh9.js";
+import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-D66Y5zC7.js";
+import { t as formatDocsLink } from "./links-BNjLUJ9U.js";
+import { t as renderTable } from "./table-j8Ayarot.js";
+import { n as resolveWideAreaDiscoveryDomain, t as getWideAreaZonePath } from "./widearea-dns-BOgHvO4O.js";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+//#region src/cli/dns-cli.ts
+function run(cmd, args, opts) {
+	const res = spawnSync(cmd, args, {
+		encoding: "utf-8",
+		stdio: opts?.inherit ? "inherit" : "pipe"
+	});
+	if (res.error) throw res.error;
+	if (!opts?.allowFailure && res.status !== 0) {
+		const errText = typeof res.stderr === "string" && res.stderr.trim() ? res.stderr.trim() : `exit ${res.status ?? "unknown"}`;
+		throw new Error(`${cmd} ${args.join(" ")} failed: ${errText}`);
+	}
+	return typeof res.stdout === "string" ? res.stdout : "";
+}
+function writeFileSudoIfNeeded(filePath, content) {
+	try {
+		fs.writeFileSync(filePath, content, "utf-8");
+		return;
+	} catch (err) {
+		const code = err.code;
+		if (code !== "EACCES" && code !== "EPERM") throw err instanceof Error ? err : new Error(String(err));
+	}
+	const res = spawnSync("sudo", ["tee", filePath], {
+		input: content,
+		encoding: "utf-8",
+		stdio: [
+			"pipe",
+			"ignore",
+			"inherit"
+		]
+	});
+	if (res.error) throw res.error;
+	if (res.status !== 0) throw new Error(`sudo tee ${filePath} failed: exit ${res.status ?? "unknown"}`);
+}
+function mkdirSudoIfNeeded(dirPath) {
+	try {
+		fs.mkdirSync(dirPath, { recursive: true });
+		return;
+	} catch (err) {
+		const code = err.code;
+		if (code !== "EACCES" && code !== "EPERM") throw err instanceof Error ? err : new Error(String(err));
+	}
+	run("sudo", [
+		"mkdir",
+		"-p",
+		dirPath
+	], { inherit: true });
+}
+function zoneFileNeedsBootstrap(zonePath) {
+	if (!fs.existsSync(zonePath)) return true;
+	try {
+		const content = fs.readFileSync(zonePath, "utf-8");
+		return !/\bSOA\b/.test(content) || !/\bNS\b/.test(content);
+	} catch {
+		return true;
+	}
+}
+function detectBrewPrefix() {
+	const prefix = run("brew", ["--prefix"]).trim();
+	if (!prefix) throw new Error("failed to resolve Homebrew prefix");
+	return prefix;
+}
+function ensureImportLine(corefilePath, importGlob) {
+	const existing = fs.readFileSync(corefilePath, "utf-8");
+	if (existing.includes(importGlob)) return false;
+	writeFileSudoIfNeeded(corefilePath, `${existing.replace(/\s*$/, "")}\n\nimport ${importGlob}\n`);
+	return true;
+}
+function registerDnsCli(program) {
+	program.command("dns").description("DNS helpers for wide-area discovery (Tailscale + CoreDNS)").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/dns", "docs.remoteclaw.org/cli/dns")}\n`).command("setup").description("Set up CoreDNS to serve your discovery domain for unicast DNS-SD (Wide-Area Bonjour)").option("--domain <domain>", "Wide-area discovery domain (e.g. remoteclaw.internal)").option("--apply", "Install/update CoreDNS config and (re)start the service (requires sudo)", false).action(async (opts) => {
+		const cfg = loadConfig();
+		const tailnetIPv4 = pickPrimaryTailnetIPv4();
+		const tailnetIPv6 = pickPrimaryTailnetIPv6();
+		const wideAreaDomain = resolveWideAreaDiscoveryDomain({ configDomain: opts.domain ?? cfg.discovery?.wideArea?.domain });
+		if (!wideAreaDomain) throw new Error("No wide-area domain configured. Set discovery.wideArea.domain or pass --domain.");
+		const zonePath = getWideAreaZonePath(wideAreaDomain);
+		const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+		defaultRuntime.log(theme.heading("DNS setup"));
+		defaultRuntime.log(renderTable({
+			width: tableWidth,
+			columns: [{
+				key: "Key",
+				header: "Key",
+				minWidth: 18
+			}, {
+				key: "Value",
+				header: "Value",
+				minWidth: 24,
+				flex: true
+			}],
+			rows: [
+				{
+					Key: "Domain",
+					Value: wideAreaDomain
+				},
+				{
+					Key: "Zone file",
+					Value: zonePath
+				},
+				{
+					Key: "Tailnet IP",
+					Value: `${tailnetIPv4 ?? "—"}${tailnetIPv6 ? ` (v6 ${tailnetIPv6})` : ""}`
+				}
+			]
+		}).trimEnd());
+		defaultRuntime.log("");
+		defaultRuntime.log(theme.heading("Recommended ~/.remoteclaw/remoteclaw.json:"));
+		defaultRuntime.log(JSON.stringify({
+			gateway: { bind: "auto" },
+			discovery: { wideArea: {
+				enabled: true,
+				domain: wideAreaDomain
+			} }
+		}, null, 2));
+		defaultRuntime.log("");
+		defaultRuntime.log(theme.heading("Tailscale admin (DNS → Nameservers):"));
+		defaultRuntime.log(theme.muted(`- Add nameserver: ${tailnetIPv4 ?? "<this machine's tailnet IPv4>"}`));
+		defaultRuntime.log(theme.muted(`- Restrict to domain (Split DNS): ${wideAreaDomain.replace(/\.$/, "")}`));
+		if (!opts.apply) {
+			defaultRuntime.log("");
+			defaultRuntime.log(theme.muted("Run with --apply to install CoreDNS and configure it."));
+			return;
+		}
+		if (process.platform !== "darwin") throw new Error("dns setup is currently supported on macOS only");
+		if (!tailnetIPv4 && !tailnetIPv6) throw new Error("no tailnet IP detected; ensure Tailscale is running on this machine");
+		const prefix = detectBrewPrefix();
+		const etcDir = path.join(prefix, "etc", "coredns");
+		const corefilePath = path.join(etcDir, "Corefile");
+		const confDir = path.join(etcDir, "conf.d");
+		const importGlob = path.join(confDir, "*.server");
+		const serverPath = path.join(confDir, `${wideAreaDomain.replace(/\.$/, "")}.server`);
+		run("brew", ["list", "coredns"], { allowFailure: true });
+		run("brew", ["install", "coredns"], {
+			inherit: true,
+			allowFailure: true
+		});
+		mkdirSudoIfNeeded(confDir);
+		if (!fs.existsSync(corefilePath)) writeFileSudoIfNeeded(corefilePath, `import ${importGlob}\n`);
+		else ensureImportLine(corefilePath, importGlob);
+		const bindArgs = [tailnetIPv4, tailnetIPv6].filter((v) => Boolean(v?.trim()));
+		writeFileSudoIfNeeded(serverPath, [
+			`${wideAreaDomain.replace(/\.$/, "")}:53 {`,
+			`  bind ${bindArgs.join(" ")}`,
+			`  file ${zonePath} {`,
+			`    reload 10s`,
+			`  }`,
+			`  errors`,
+			`  log`,
+			`}`,
+			``
+		].join("\n"));
+		await fs.promises.mkdir(path.dirname(zonePath), { recursive: true });
+		if (zoneFileNeedsBootstrap(zonePath)) {
+			const serial = `${(/* @__PURE__ */ new Date()).getUTCFullYear()}${String((/* @__PURE__ */ new Date()).getUTCMonth() + 1).padStart(2, "0")}${String((/* @__PURE__ */ new Date()).getUTCDate()).padStart(2, "0")}01`;
+			const zoneLines = [
+				`; created by remoteclaw dns setup (will be overwritten by the gateway when wide-area discovery is enabled)`,
+				`$ORIGIN ${wideAreaDomain}`,
+				`$TTL 60`,
+				`@ IN SOA ns1 hostmaster ${serial} 7200 3600 1209600 60`,
+				`@ IN NS ns1`,
+				tailnetIPv4 ? `ns1 IN A ${tailnetIPv4}` : null,
+				tailnetIPv6 ? `ns1 IN AAAA ${tailnetIPv6}` : null,
+				``
+			].filter((line) => Boolean(line));
+			fs.writeFileSync(zonePath, zoneLines.join("\n"), "utf-8");
+		}
+		defaultRuntime.log("");
+		defaultRuntime.log(theme.heading("Starting CoreDNS (sudo)…"));
+		run("sudo", [
+			"brew",
+			"services",
+			"restart",
+			"coredns"
+		], { inherit: true });
+		if (cfg.discovery?.wideArea?.enabled !== true) {
+			defaultRuntime.log("");
+			defaultRuntime.log(theme.muted("Note: enable discovery.wideArea.enabled in ~/.remoteclaw/remoteclaw.json on the gateway and restart the gateway so it writes the DNS-SD zone."));
+		}
+	});
+}
+
+//#endregion
+export { registerDnsCli };

package/dist/dns-cli-CdMU5yuG.js

@@ -0,0 +1,199 @@
+import { Ct as theme, _ as defaultRuntime } from "./entry.js";
+import { i as loadConfig } from "./config-DfcqHTH-.js";
+import "./host-env-security-axRnIi8d.js";
+import "./shell-env-DBS5su07.js";
+import "./version-3QUZW8EP.js";
+import "./env-vars-CD2_baIP.js";
+import "./zod-schema-C8gEV0uz.js";
+import "./agent-scope-CJW7vnF8.js";
+import "./ip-D0zgNmBV.js";
+import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-CEudzG0i.js";
+import { t as formatDocsLink } from "./links-BFtUmGLH.js";
+import { t as renderTable } from "./table-B9zSN_7D.js";
+import { n as resolveWideAreaDiscoveryDomain, t as getWideAreaZonePath } from "./widearea-dns-CGhfClCr.js";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import fs from "node:fs";
+
+//#region src/cli/dns-cli.ts
+function run(cmd, args, opts) {
+	const res = spawnSync(cmd, args, {
+		encoding: "utf-8",
+		stdio: opts?.inherit ? "inherit" : "pipe"
+	});
+	if (res.error) throw res.error;
+	if (!opts?.allowFailure && res.status !== 0) {
+		const errText = typeof res.stderr === "string" && res.stderr.trim() ? res.stderr.trim() : `exit ${res.status ?? "unknown"}`;
+		throw new Error(`${cmd} ${args.join(" ")} failed: ${errText}`);
+	}
+	return typeof res.stdout === "string" ? res.stdout : "";
+}
+function writeFileSudoIfNeeded(filePath, content) {
+	try {
+		fs.writeFileSync(filePath, content, "utf-8");
+		return;
+	} catch (err) {
+		const code = err.code;
+		if (code !== "EACCES" && code !== "EPERM") throw err instanceof Error ? err : new Error(String(err));
+	}
+	const res = spawnSync("sudo", ["tee", filePath], {
+		input: content,
+		encoding: "utf-8",
+		stdio: [
+			"pipe",
+			"ignore",
+			"inherit"
+		]
+	});
+	if (res.error) throw res.error;
+	if (res.status !== 0) throw new Error(`sudo tee ${filePath} failed: exit ${res.status ?? "unknown"}`);
+}
+function mkdirSudoIfNeeded(dirPath) {
+	try {
+		fs.mkdirSync(dirPath, { recursive: true });
+		return;
+	} catch (err) {
+		const code = err.code;
+		if (code !== "EACCES" && code !== "EPERM") throw err instanceof Error ? err : new Error(String(err));
+	}
+	run("sudo", [
+		"mkdir",
+		"-p",
+		dirPath
+	], { inherit: true });
+}
+function zoneFileNeedsBootstrap(zonePath) {
+	if (!fs.existsSync(zonePath)) return true;
+	try {
+		const content = fs.readFileSync(zonePath, "utf-8");
+		return !/\bSOA\b/.test(content) || !/\bNS\b/.test(content);
+	} catch {
+		return true;
+	}
+}
+function detectBrewPrefix() {
+	const prefix = run("brew", ["--prefix"]).trim();
+	if (!prefix) throw new Error("failed to resolve Homebrew prefix");
+	return prefix;
+}
+function ensureImportLine(corefilePath, importGlob) {
+	const existing = fs.readFileSync(corefilePath, "utf-8");
+	if (existing.includes(importGlob)) return false;
+	writeFileSudoIfNeeded(corefilePath, `${existing.replace(/\s*$/, "")}\n\nimport ${importGlob}\n`);
+	return true;
+}
+function registerDnsCli(program) {
+	program.command("dns").description("DNS helpers for wide-area discovery (Tailscale + CoreDNS)").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/dns", "docs.remoteclaw.org/cli/dns")}\n`).command("setup").description("Set up CoreDNS to serve your discovery domain for unicast DNS-SD (Wide-Area Bonjour)").option("--domain <domain>", "Wide-area discovery domain (e.g. remoteclaw.internal)").option("--apply", "Install/update CoreDNS config and (re)start the service (requires sudo)", false).action(async (opts) => {
+		const cfg = loadConfig();
+		const tailnetIPv4 = pickPrimaryTailnetIPv4();
+		const tailnetIPv6 = pickPrimaryTailnetIPv6();
+		const wideAreaDomain = resolveWideAreaDiscoveryDomain({ configDomain: opts.domain ?? cfg.discovery?.wideArea?.domain });
+		if (!wideAreaDomain) throw new Error("No wide-area domain configured. Set discovery.wideArea.domain or pass --domain.");
+		const zonePath = getWideAreaZonePath(wideAreaDomain);
+		const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+		defaultRuntime.log(theme.heading("DNS setup"));
+		defaultRuntime.log(renderTable({
+			width: tableWidth,
+			columns: [{
+				key: "Key",
+				header: "Key",
+				minWidth: 18
+			}, {
+				key: "Value",
+				header: "Value",
+				minWidth: 24,
+				flex: true
+			}],
+			rows: [
+				{
+					Key: "Domain",
+					Value: wideAreaDomain
+				},
+				{
+					Key: "Zone file",
+					Value: zonePath
+				},
+				{
+					Key: "Tailnet IP",
+					Value: `${tailnetIPv4 ?? "—"}${tailnetIPv6 ? ` (v6 ${tailnetIPv6})` : ""}`
+				}
+			]
+		}).trimEnd());
+		defaultRuntime.log("");
+		defaultRuntime.log(theme.heading("Recommended ~/.remoteclaw/remoteclaw.json:"));
+		defaultRuntime.log(JSON.stringify({
+			gateway: { bind: "auto" },
+			discovery: { wideArea: {
+				enabled: true,
+				domain: wideAreaDomain
+			} }
+		}, null, 2));
+		defaultRuntime.log("");
+		defaultRuntime.log(theme.heading("Tailscale admin (DNS → Nameservers):"));
+		defaultRuntime.log(theme.muted(`- Add nameserver: ${tailnetIPv4 ?? "<this machine's tailnet IPv4>"}`));
+		defaultRuntime.log(theme.muted(`- Restrict to domain (Split DNS): ${wideAreaDomain.replace(/\.$/, "")}`));
+		if (!opts.apply) {
+			defaultRuntime.log("");
+			defaultRuntime.log(theme.muted("Run with --apply to install CoreDNS and configure it."));
+			return;
+		}
+		if (process.platform !== "darwin") throw new Error("dns setup is currently supported on macOS only");
+		if (!tailnetIPv4 && !tailnetIPv6) throw new Error("no tailnet IP detected; ensure Tailscale is running on this machine");
+		const prefix = detectBrewPrefix();
+		const etcDir = path.join(prefix, "etc", "coredns");
+		const corefilePath = path.join(etcDir, "Corefile");
+		const confDir = path.join(etcDir, "conf.d");
+		const importGlob = path.join(confDir, "*.server");
+		const serverPath = path.join(confDir, `${wideAreaDomain.replace(/\.$/, "")}.server`);
+		run("brew", ["list", "coredns"], { allowFailure: true });
+		run("brew", ["install", "coredns"], {
+			inherit: true,
+			allowFailure: true
+		});
+		mkdirSudoIfNeeded(confDir);
+		if (!fs.existsSync(corefilePath)) writeFileSudoIfNeeded(corefilePath, `import ${importGlob}\n`);
+		else ensureImportLine(corefilePath, importGlob);
+		const bindArgs = [tailnetIPv4, tailnetIPv6].filter((v) => Boolean(v?.trim()));
+		writeFileSudoIfNeeded(serverPath, [
+			`${wideAreaDomain.replace(/\.$/, "")}:53 {`,
+			`  bind ${bindArgs.join(" ")}`,
+			`  file ${zonePath} {`,
+			`    reload 10s`,
+			`  }`,
+			`  errors`,
+			`  log`,
+			`}`,
+			``
+		].join("\n"));
+		await fs.promises.mkdir(path.dirname(zonePath), { recursive: true });
+		if (zoneFileNeedsBootstrap(zonePath)) {
+			const serial = `${(/* @__PURE__ */ new Date()).getUTCFullYear()}${String((/* @__PURE__ */ new Date()).getUTCMonth() + 1).padStart(2, "0")}${String((/* @__PURE__ */ new Date()).getUTCDate()).padStart(2, "0")}01`;
+			const zoneLines = [
+				`; created by remoteclaw dns setup (will be overwritten by the gateway when wide-area discovery is enabled)`,
+				`$ORIGIN ${wideAreaDomain}`,
+				`$TTL 60`,
+				`@ IN SOA ns1 hostmaster ${serial} 7200 3600 1209600 60`,
+				`@ IN NS ns1`,
+				tailnetIPv4 ? `ns1 IN A ${tailnetIPv4}` : null,
+				tailnetIPv6 ? `ns1 IN AAAA ${tailnetIPv6}` : null,
+				``
+			].filter((line) => Boolean(line));
+			fs.writeFileSync(zonePath, zoneLines.join("\n"), "utf-8");
+		}
+		defaultRuntime.log("");
+		defaultRuntime.log(theme.heading("Starting CoreDNS (sudo)…"));
+		run("sudo", [
+			"brew",
+			"services",
+			"restart",
+			"coredns"
+		], { inherit: true });
+		if (cfg.discovery?.wideArea?.enabled !== true) {
+			defaultRuntime.log("");
+			defaultRuntime.log(theme.muted("Note: enable discovery.wideArea.enabled in ~/.remoteclaw/remoteclaw.json on the gateway and restart the gateway so it writes the DNS-SD zone."));
+		}
+	});
+}
+
+//#endregion
+export { registerDnsCli };